Content-Security-Policy

klarna.com sends an enforcing CSP. It is nonce-based and uses 'strict-dynamic'.

default-src 'self';script-src 'self' 'strict-dynamic' 'wasm-unsafe-eval' 'nonce-51b4d731-522f-44a0-abd0-9f58613f246c' 'report-sample' https://owp.klarna.com/ https://cdn.cookielaw.org/;style-src 'self' 'unsafe-inline' 'report-sample' https://owp.klarna.com/ https://www.gstatic.com/ https://x.klarnacdn.net/;img-src 'self' data: blob: https: chrome-extension:;media-src 'self' data: https: blob:;connect-src 'self' *.google.com *.google-analytics.com *.googlesyndication.com *.googletagmanager.com www.googleadservices.com *.adtrafficquality.google fonts.googleapis.com translate.googleapis.com fonts.gstatic.com www.gstatic.com ssl.google-analytics.com csi.gstatic.com *.g.doubleclick.net bat.bing.com *.klarna.com klarna-eu.api.unboxai.com klarna.atlassian.net production.videos.production.eu1.influencer-platform.klarna.net x.klarnacdn.net assets.klarnacdn.net api.videoly.co o24547.ingest.us.sentry.io *.onetrust.com *.cookielaw.org cookies-data.onetrust.io www.youtube.com images.ctfassets.net videos.ctfassets.net images.pricerunner.com evt2.klarna.app tr.snapchat.com tr6.snapchat.com sc-static.net ams.creativecdn.com eu-production-asp-ingestion-assets-upload-hold.s3.eu-west-1.amazonaws.com ;font-src 'self' https: data:;frame-src 'self' *.snapchat.com *.klarna.com *.klarnacdn.net *.adtrafficquality.google *.googlesyndication.com *.googletagmanager.com *.googleadservices.com *.googletagservices.com *.doubleclick.net *.google.com www.youtube.com www.youtube-nocookie.com *.criteo.com osm.klarnaservices.com open.spotify.com ams.creativecdn.com hackerone.com neu.mein-onlineantrag.de platform.twitter.com syndication.twitter.com;base-uri 'self';manifest-src 'self';object-src 'none';frame-ancestors 'self' *.klarna.com app.contentful.com;upgrade-insecure-requests

Directive	Sources
default-src	'self'
script-src	'self' 'strict-dynamic' 'wasm-unsafe-eval' 'nonce-51b4d731-522f-44a0-abd0-9f58613f246c' 'report-sample' https://owp.klarna.com/ https://cdn.cookielaw.org/
style-src	'self' 'unsafe-inline' 'report-sample' https://owp.klarna.com/ https://www.gstatic.com/ https://x.klarnacdn.net/
img-src	'self' data: blob: https: chrome-extension:
media-src	'self' data: https: blob:
connect-src	'self' *.google.com *.google-analytics.com *.googlesyndication.com *.googletagmanager.com www.googleadservices.com *.adtrafficquality.google fonts.googleapis.com translate.googleapis.com fonts.gstatic.com www.gstatic.com ssl.google-analytics.com csi.gstatic.com *.g.doubleclick.net bat.bing.com *.klarna.com klarna-eu.api.unboxai.com klarna.atlassian.net production.videos.production.eu1.influencer-platform.klarna.net x.klarnacdn.net assets.klarnacdn.net api.videoly.co o24547.ingest.us.sentry.io *.onetrust.com *.cookielaw.org cookies-data.onetrust.io www.youtube.com images.ctfassets.net videos.ctfassets.net images.pricerunner.com evt2.klarna.app tr.snapchat.com tr6.snapchat.com sc-static.net ams.creativecdn.com eu-production-asp-ingestion-assets-upload-hold.s3.eu-west-1.amazonaws.com
font-src	'self' https: data:
frame-src	'self' *.snapchat.com *.klarna.com *.klarnacdn.net *.adtrafficquality.google *.googlesyndication.com *.googletagmanager.com *.googleadservices.com *.googletagservices.com *.doubleclick.net *.google.com www.youtube.com www.youtube-nocookie.com *.criteo.com osm.klarnaservices.com open.spotify.com ams.creativecdn.com hackerone.com neu.mein-onlineantrag.de platform.twitter.com syndication.twitter.com
base-uri	'self'
manifest-src	'self'
object-src	'none'
frame-ancestors	'self' *.klarna.com app.contentful.com
upgrade-insecure-requests	(empty)

Headers sent

Header	Value
strict-transport-security	max-age=31536000; includeSubDomains; preload
x-content-type-options	nosniff
referrer-policy	strict-origin-when-cross-origin
cross-origin-embedder-policy	unsafe-none
server	envoy

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan